प्लेटफ़ॉर्म
wordpress
घटक
multi-crypto-currency-payment
में ठीक किया गया
2.0.8
CVE-2025-48141 describes a SQL Injection vulnerability discovered in Multi CryptoCurrency Payments, a WordPress plugin. This flaw allows attackers to inject malicious SQL code, potentially gaining unauthorized access to sensitive data and compromising the entire system. The vulnerability affects versions from 0.0.0 through 2.0.7, and a fix is available in version 2.0.4.
Successful exploitation of this SQL Injection vulnerability could allow an attacker to bypass authentication, read, modify, or delete data within the database. This includes sensitive information such as user credentials, transaction details, and potentially cryptocurrency wallet information. Depending on the database structure and permissions, an attacker might also be able to execute arbitrary commands on the underlying server, leading to complete system compromise. The impact is particularly severe given the plugin's purpose – handling cryptocurrency payments, which inherently involves high-value financial data. A similar SQL Injection vulnerability in a financial plugin could lead to significant financial losses and reputational damage.
CVE-2025-48141 was publicly disclosed on 2025-06-09. The vulnerability's severity is considered CRITICAL due to the potential for complete system compromise. As of this writing, there are no publicly available proof-of-concept exploits, but the ease of SQL Injection exploitation suggests a high probability of exploitation if left unpatched. It is not currently listed on the CISA KEV catalog.
WordPress websites utilizing the Multi CryptoCurrency Payments plugin, particularly those running versions 0.0.0 through 2.0.7, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose the data of others. Websites that have not implemented robust input validation practices are also at increased risk.
• wordpress / composer / npm:
grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/multi-crypto-currency-payment/• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/multi-crypto-currency-payment/ | grep SQL• database (mysql):
SELECT @@version;• wordpress / composer / npm:
wp plugin list | grep multi-crypto-currency-paymentdisclosure
एक्सप्लॉइट स्थिति
EPSS
0.06% (18% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-48141 is to immediately upgrade Multi CryptoCurrency Payments to version 2.0.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with SQL Injection protection rules. Carefully review and sanitize all user inputs to prevent malicious SQL code from being injected. Monitor database logs for suspicious SQL queries that might indicate an attempted exploitation. Implement strict database user permissions to limit the potential damage from a successful attack. After upgrade, confirm by attempting a series of SQL injection payloads through the plugin's interface to ensure the vulnerability is resolved.
Actualice el plugin Multi CryptoCurrency Payments a una versión posterior a 2.0.7 para mitigar la vulnerabilidad de inyección SQL. Verifique la página del plugin en WordPress.org para obtener la última versión disponible y siga las instrucciones de actualización proporcionadas por el desarrollador. Asegúrese de realizar una copia de seguridad de su sitio web antes de realizar cualquier actualización.
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-48141 is a critical SQL Injection vulnerability affecting Multi CryptoCurrency Payments versions 0.0.0–2.0.7, allowing attackers to inject malicious SQL code and potentially compromise the database.
If you are using Multi CryptoCurrency Payments version 0.0.0 through 2.0.7 on your WordPress site, you are potentially affected by this vulnerability.
Upgrade Multi CryptoCurrency Payments to version 2.0.4 or later to remediate the SQL Injection vulnerability. Consider WAF rules as a temporary workaround.
While no public exploits are currently known, the ease of SQL Injection exploitation suggests a high probability of exploitation if left unpatched.
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and update information.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।